diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-06 02:39:48 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-06 02:39:48 +0000 |
| commit | ccc43f1eac8a75f255b97495fb69e2965f805480 (patch) | |
| tree | 9579f7f7420783086283c457cbb97fd613fdc21f | |
| parent | Starting agetty with --nohostname option. (diff) | |
| download | systemd-ccc43f1eac8a75f255b97495fb69e2965f805480.tar.xz systemd-ccc43f1eac8a75f255b97495fb69e2965f805480.zip | |
Mounting /proc with hidepid=2 option.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
| -rw-r--r-- | debian/patches/progress-linux/0002-proc-hidepid.patch | 27 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
2 files changed, 28 insertions, 0 deletions
diff --git a/debian/patches/progress-linux/0002-proc-hidepid.patch b/debian/patches/progress-linux/0002-proc-hidepid.patch new file mode 100644 index 0000000..97819e1 --- /dev/null +++ b/debian/patches/progress-linux/0002-proc-hidepid.patch @@ -0,0 +1,27 @@ +Author: Daniel Baumann <daniel.baumann@progress-linux.org> +Description: Mounting /proc with hidepid=2 option. + +diff -Naurp systemd.orig/src/core/mount-setup.c systemd/src/core/mount-setup.c +--- systemd.orig/src/core/mount-setup.c ++++ systemd/src/core/mount-setup.c +@@ -61,7 +61,7 @@ typedef struct MountPoint { + static const MountPoint mount_table[] = { + { "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, + NULL, MNT_FATAL|MNT_IN_CONTAINER }, +- { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, ++ { "proc", "/proc", "proc", "hidepid=2", MS_NOSUID|MS_NOEXEC|MS_NODEV, + NULL, MNT_FATAL|MNT_IN_CONTAINER }, + { "devtmpfs", "/dev", "devtmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, + NULL, MNT_FATAL|MNT_IN_CONTAINER }, +diff -Naurp systemd.orig/src/nspawn/nspawn-mount.c systemd/src/nspawn/nspawn-mount.c +--- systemd.orig/src/nspawn/nspawn-mount.c ++++ systemd/src/nspawn/nspawn-mount.c +@@ -512,7 +512,7 @@ int mount_all(const char *dest, + + static const MountPoint mount_table[] = { + /* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing) */ +- { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, ++ { "proc", "/proc", "proc", "hidepid=2", MS_NOSUID|MS_NOEXEC|MS_NODEV, + MOUNT_FATAL|MOUNT_IN_USERNS }, + + { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, diff --git a/debian/patches/series b/debian/patches/series index 375a772..468d16c 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -78,3 +78,4 @@ debian/Let-graphical-session-pre.target-be-manually-started.patch debian/Add-env-variable-for-machine-ID-path.patch debian/Drop-seccomp-system-call-filter-for-udev.patch progress-linux/0001-agetty-nohostname.patch +progress-linux/0002-proc-hidepid.patch |